Getting Started with Magic Links

Magic Links enables people to edit an entry they submitted without logging in, through a secure link that expires. This guide covers setting it up and stopping a link that was already sent.

Prefer to watch the video?

Basic Setup #

Enable Magic Links for a View

1. Edit your View.
2. In the Settings box, click the Magic Links tab.
3. Check Enable Magic Links.
4. Under Email Field, select the field that holds the submitter’s email address. A link then works only while its address matches the one saved in the entry, or is in Allowed Emails.
5. If someone else needs to edit every entry in the View, add their address to Allowed Emails. Separate addresses with commas or new lines, and use *@example.com to allow every address at a domain.
6. Under Link Expiration, choose how long a link works after it’s created. The default is 15 minutes, and the longest choice is 12 hours. A change applies to new links only.
7. Under Edit Window, choose how long after an entry is submitted it can be edited through a link. The default is 2 days, so links stop working for entries older than that. Choose a longer window or No time limit if people need to edit older entries.
8. Save the View.

Allow Entry Deletion and One-Time Access are off by default. Allow Entry Deletion lets someone with a link delete the entry, as described in Allowing users to delete entries when using a Magic Link. One-Time Access ends a link once it has been used to save an edit, so each edit needs a new link.

Anyone who has a link can use it until it stops working. If you leave Email Field set to Don’t validate by email field, the address in a link doesn’t have to match the entry or Allowed Emails. Changing the entry’s address or Allowed Emails then doesn’t stop a link that was already sent. In Magic Links 1.3.0 and later, only addresses in Allowed Emails can then request a link from the View.

Usage #

Links for new and existing entries

When someone submits the form, Magic Links creates a link for the new entry right away, so the {gv_magic_link} merge tag works in that form’s notifications and confirmation. This needs a valid address in the Email Field, or in the form’s first Email field with Don’t validate by email field. While the entry’s link hasn’t expired, the merge tag reuses it with the entry’s current email address. After it expires, the merge tag creates a new one. Each link expires after the View’s Link Expiration, counted from when it was created. When someone opens a link that has expired, the page shows a form where they can request a new one.

Using Magic Links

A magic link for editing opens the entry’s Edit Entry screen, on the View or on the page where the View is embedded. It can’t open the original form page. A magic link for deleting an entry removes it as soon as someone opens it. See Allowing users to delete entries when using a Magic Link.

Magic Links can be used in multiple ways:

Via Merge Tags

Use the {gv_magic_link} merge tag in your form notifications or confirmations.

Example: You can edit your entry here: {gv_magic_link view_id=123 text="Edit Entry"}

Learn more about the merge tag in the merge tag documentation.

From a View in GravityView

• When the View shows an Edit Entry link, logged-out visitors see it too.
• Clicking it opens a form that asks for their email address.
• If the address matches the entry’s Email Field or is in Allowed Emails, and the entry is within the Edit Window, Magic Links emails a new link to it with the subject “Your link to edit an entry”.
• The email is sent in the background, so on some servers it takes a few minutes to arrive.

Security Features #

Magic Links includes several security measures:

• Time-limited links (configurable per View)
• Email verification
• Secure hash generation
• View-specific settings
• The request form shows the same message whether or not an address matches

Stopping a link that was already sent #

Magic Links has no cancel button. Each of the following stops a link that was already sent, for example one that went to the wrong address:

• If the entry’s email address is wrong, correct it. With an Email Field selected, a link made for the old address stops right away, unless that address is in Allowed Emails.
• Request a new link from the View’s request form with an address that matches the entry’s Email Field or is in Allowed Emails. Only the newest link for an entry and View works, so the earlier one stops once the new link is created. Resending a notification that contains {gv_magic_link} doesn’t cancel an earlier link on its own.
• Remove the address, and any *@ rule that covers it, from Allowed Emails, then save the View. With an Email Field selected, its links stop unless it’s also the address saved in the entry. With Don’t validate by email field, removing it doesn’t stop a link that was already sent.
• With One-Time Access on, a link stops once it has been used to save an edit.
• Once the entry is older than the Edit Window, its links stop working.
• Unchecking Enable Magic Links and saving the View stops every link for the View at once. If you turn it back on, links that are still valid work again.

Best Practices #

1. Email Field Selection
   • Choose the most reliable email field in your form
2. Expiration Settings
   • Set appropriate expiration times based on your needs
   • Consider the urgency of edits and security requirements
   • Start with a low expiration time and increase as needed

Troubleshooting #

Common issues and solutions:

1. Links Not Working
   • Check if the email field is correctly configured
   • Verify the View’s Magic Links settings are enabled
   • Ensure the entry has a valid email address
   • Check the Edit Window: with the default of 2 days, links don’t work for entries submitted more than 2 days ago
   • Use the newest link, since requesting a new one stops the earlier links for that entry
2. Links Expiring Too Quickly
   • Raise Link Expiration in the View settings, up to 12 hours
   • Consider your security requirements
3. Email Not Received
   • Check your WordPress email settings
   • Verify the email address is correct in the entry
   • Check spam folders
   • Wait a few minutes, since the request form sends its email in the background
   • With Don’t validate by email field, the request form sends links only to addresses in Allowed Emails